Topic starter
24/06/2026 9:47 pm
TL;DR: Biometric spoofing turns fingerprints, faces, and iris scans into presentation-attack targets, and the article explains why liveness detection is now central to stronger identity assurance, according to 1Kosmos. The issue is not that biometrics fail outright, but that assurance collapses when systems cannot prove the sample came from a live person.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Combatting Biometric Spoofing”.
Key questions
Q: What breaks when liveness detection is used as the only biometric control?
A: Liveness detection breaks down when it is treated as a standalone answer instead of one signal in a broader assurance chain.
Q: Why do biometrics need liveness checks in identity verification?
A: Biometrics alone can be replayed, copied, or faked with images and video.
Q: What is the difference between active and passive liveness checks?
A: Active liveness checks ask the user to perform a task such as blinking, smiling, or turning the head.
Practitioner guidance
- Map every biometric control to its assurance purpose Separate identity proofing, authentication, and step-up verification so each biometric use case has a clearly defined assurance target and failure tolerance.
- Add liveness detection to high-risk flows Use active or passive liveness checks for remote enrollment, privileged access, and other flows where a spoofed sample would have material impact.
- Test for presentation attacks, not just false matches Include print attacks, replay attacks, synthetic fingerprints, and deepfake-style video inputs in testing so the control is evaluated against real attack paths.
Bottom line: Biometric spoofing weakens assurance when systems confuse a matching trait with proof that a live person is present.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:46 am
Biometric spoofing exposes a presentation problem, not a biometric failure. The security issue is not that fingerprints, faces, or irises are inherently weak. The issue is that systems often treat resemblance as proof of presence, which allows an attacker to substitute a fabricated sample for a live one. That is a governance failure in the assurance layer, not a defect in the modality itself. Practitioners should treat spoof resistance as part of identity evidence quality.
A question worth separating out:
Q: How can organisations keep biometrics inside a broader identity assurance model?
A: Treat biometrics as one signal inside proofing and authentication, not as a standalone trust decision. Organisations should pair biometric checks with identity evidence validation, device and channel controls, exception handling, and review paths for low-confidence results so the programme does not overstate what a scan actually proves.
👉 Read our full editorial: Biometric spoofing exposes the limits of biometric identity assurance